Encrypt Sensitive Data with AI Prompts

Add encryption for sensitive database fields in my application.

Fields to encrypt: list your sensitive fields, e.g., SSN, credit card, personal notes

Requirements:

1. Use AES-256-GCM for encryption (authenticated encryption)
2. Store encryption keys in environment variables, not in code
3. Create encrypt/decrypt utility functions
4. Handle the key properly (never log it, use secure memory)
5. Include IV (initialization vector) with each encrypted value

Implementation should:

• Encrypt before saving to database
• Decrypt when reading from database
• Work with my ORM (Prisma/Drizzle/Mongoose)
• Handle migration of existing unencrypted data
• Allow key rotation in the future

Also explain how to store the encrypted data (base64, hex, binary).

Create a secure encryption utility for Node.js using the built-in crypto module.

Create functions for:

1. encrypt(plaintext, key) - returns encrypted string with IV
2. decrypt(ciphertext, key) - returns original plaintext
3. generateKey() - creates a secure encryption key
4. deriveKey(password, salt) - derives key from password

Requirements:

• Use AES-256-GCM (authenticated encryption)
• Include authentication tag to prevent tampering
• Generate random IV for each encryption
• Return format: base64(iv + authTag + ciphertext)
• TypeScript types for all functions

Also create:

• Key rotation helper (re-encrypt with new key)
• Secure comparison function for encrypted values
• Error handling for decryption failures (don't leak info)

Add encryption layer for sensitive API payloads beyond HTTPS.

Use case: Extra protection for highly sensitive data (health records, financial data)

Implement:

1. Client-side encryption before sending to API
2. Server-side decryption on receipt
3. Key exchange mechanism (or use pre-shared keys)
4. Request signing to prevent tampering

Create:

• Client utility (JavaScript/TypeScript)
• Server middleware to decrypt incoming requests
• Response encryption for sensitive return data
• Key management approach

This is for defense in depth, not replacing HTTPS.

Set up proper encryption key management for my application.

I need:

1. Secure key storage (not in code or config files)
2. Key rotation strategy without downtime
3. Different keys for different data types
4. Audit logging of key usage

Options to consider:

• Environment variables (basic)
• AWS KMS / Google Cloud KMS / Azure Key Vault
• HashiCorp Vault
• Encrypted key file with master password

For my scale: describe - startup/small/enterprise

Create:

• Key storage implementation
• Key rotation procedure
• Backup and recovery plan
• Access control for keys